Data Processing Addendum and Sub-processors

DRAFT — requires attorney review Not legal advice. This addendum is not in force until counsel approves it, an effective date is published and the customer accepts it.

This addendum ("DPA") forms part of the Terms of Service between TODO(owner): legal entity name ("Mopful", "we") and the company that uses Mopful ("Customer"). If the two conflict about personal information, this DPA controls.

1. Roles

For the personal information in Customer's work records (the Customer Data, described in section 3), Customer is the controller or "business" and Mopful is the processor or "service provider". For account data, billing, website and marketing data, Mopful decides how the data is used, as described in the Privacy Policy.

2. Instructions

We process Customer Data only to provide, secure, back up and support the service for Customer, to generate and deliver the reports Customer requests, and as Customer instructs through the product and its settings, or in writing. If we believe an instruction breaks the law, we will tell Customer. We will not sell Customer Data, share it for cross-context behavioral advertising, retain, use or disclose it outside the direct business relationship with Customer, or combine it with other data, except as the law allows a service provider to do.

3. What is processed

• People: Customer's owners, managers, supervisors, cleaners, viewers and client users, and people named in Customer's records (for example site contacts).
• Data: names, email addresses or phone numbers, roles, PIN hashes, work records and their times, one location reading at arrival, one at departure and one at inspection start, photos, notes, site access codes (encrypted), activity history and device identifiers.
• Not intended: protected health information, payment card numbers, government identifiers or biometric data. Customer must not upload them. We do not sign business associate agreements.

4. Confidentiality and personnel

People who can access Customer Data are bound by confidentiality and get access only as needed to run and support the service.

5. Security

We maintain the measures in section 12. They are meant to be appropriate to the risk, and we update them over time without lowering the overall level of protection.

6. Sub-processors

Customer agrees that we may use the sub-processors in section 13. We will tell Customer of a new or replaced sub-processor at least TODO(owner): notice period for new sub-processors, for example 30 days in advance, by email to the account owner or by updating this page. Customer may object on reasonable data-protection grounds within that period. If we cannot resolve the objection, Customer may cancel the affected service and we will refund the unused prepaid part of the current period. We stay responsible for our sub-processors and bind them to terms no less protective than this DPA.

7. Where data is stored and who can access it

Customer Data is stored in the United States. Sub-processors and our support team may access it from other countries, under contract and only as needed to provide and support the service. TODO(attorney): confirm whether any transfer mechanism or notice is needed for this access, and whether state law requires more.

8. Requests from people and help from us

The product lets Customer export, correct and delete data. If a person asks us directly about Customer Data, we will point them to Customer, unless the law requires otherwise. We will give reasonable help with Customer's responses to privacy requests, privacy assessments and regulator inquiries, at TODO(owner): cost terms for assistance beyond the product's tools.

9. Personal data breach

We will notify Customer without undue delay and in any event within 72 hours after we become aware of a personal data breach affecting Customer Data. The notice goes to the account owner's email address and will say what we know: what happened, the data and people affected, likely consequences, what we have done and what Customer can do. We will keep Customer updated, and give more detail as we learn it. Customer is responsible for notices to its own employees, clients and regulators.

10. Return and deletion

• During the term: Customer can export and delete data in the product.
• Account deletion: when Customer asks to delete the company account, billing stops at once, the account is disabled for a 30-day grace period, and then Customer Data is deleted from our live systems (database, media storage and report links).
• Backups: we keep rolling backup copies for 30 days. A deleted record can remain in a backup for up to 30 days after deletion, plus one daily run, and then expires. Backup data is not used for any other purpose and is not restored except to recover from our own failure.
• Retention by plan: proof photos are deleted after the retention period of Customer's plan (12, 24 or 36 months), and the activity history after 36 months.
• Records of people who leave: a person's name is replaced with "Former team member" on Customer's records when that person deletes their account; Customer's records stay with Customer.
• Law: we may keep data where the law requires, and then only for that purpose.

11. Audits

On written request, no more than once a year, we will give Customer the information reasonably needed to show that we meet this DPA, such as a summary of our security practices and our sub-processor agreements. TODO(attorney): decide whether to offer third-party audit reports or on-site audits, and who pays.

12. Security measures

• Access controls by role and by assigned site, with deactivation that signs a person out.
• PINs stored as salted hashes; limits on sign-in and PIN attempts per account, device and address.
• Site access codes encrypted at rest; every view logged.
• Encryption in transit; signed, expiring links for photos and reports.
• Separation of each company's data and automated tests of the access rules.
• Rolling daily backups kept 30 days, with the read-only credentials used for the media backup kept separate from the live system's credentials.
• Logging of administrative actions; error monitoring.
• Secrets kept in a managed secret store, not in source code.

13. List of sub-processors

Website analytics and advertising tags (Google Analytics 4, Google Ads, Microsoft Advertising) run only after consent on our marketing website. They do not receive Customer Data from the app and are described in the Privacy Policy.

14. Liability and term

Liability under this DPA is subject to the limits in the Terms of Service. TODO(attorney): confirm whether data-protection claims should have a separate cap. This DPA lasts as long as we process Customer Data.

15. Contact

Questions about this DPA or to receive a signed copy: support@mopful.com. Postal address: TODO(owner): US postal address for legal notices and CAN-SPAM.